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ABSTRACT 

Rejection sampling is a well-known method to sample from 
a target distribution, given the ability to sample from a 
given distribution. The method has been first formalized 
by von Neumann (1951) and has many applications in clas- 
sical computing. We define a quantum analogue of rejection 
sampling: given a black box producing a coherent superpo- 
sition of (possibly unknown) quantum states with some am- 
plitudes, the problem is to prepare a coherent superposition 
of the same states, albeit with different target amplitudes. 
The main result of this paper is a tight characterization of 
the query complexity of this quantum state generation prob- 
lem. We exhibit an algorithm, which we call quantum rejec- 
tion sampling, and analyze its cost using semidefinite pro- 
gramming. Our proof of a matching lower bound is based 
on the automorphism principle which allows to symmetrize 
any algorithm over the automorphism group of the prob- 
lem. Our main technical innovation is an extension of the 
automorphism principle to continuous groups that arise for 
quantum state generation problems where the oracle encodes 
unknown quantum states, instead of just classical data. Fur- 
thermore, we illustrate how quantum rejection sampling may 
be used as a primitive in designing quantum algorithms, by 
providing three different applications. We first show that it 
was implicitly used in the quantum algorithm for linear sys- 
tems of equations by Harrow, Hassidim and Lloyd. Secondly, 
we show that it can be used to speed up the main step in the 
quantum Metropolis sampling algorithm by Temme et al. 
Finally, we derive a new quantum algorithm for the hidden 
shift problem of an arbitrary Boolean function and relate its 
query complexity to "water-filling" of the Fourier spectrum. 

1. INTRODUCTION 

We address the problem of preparing a desired target 
quantum state into the memory of a quantum computer. 
It is of course unreasonable to try to find an efficient quan- 
tum algorithm to achieve this for general quantum states. 
Indeed, if any state could be prepared efficiently such diffi- 



cult tasks as preparing witnesses for QMA-complete prob- 
lems [30] could be solved efficiently, a task believed to be 
impossible even if classical side-information about the quan- 
tum state is provided [2]. On the other hand, many inter- 
esting computational problems can be related to quantum 
state generation problems that carry some additional struc- 
ture which might be exploited by an efficient algorithm. 

Among the most tantalizing examples of problems that 
are reducible to quantum state generation is the Graph Iso- 
morphism problem [33] which could be solved by preparing 
the quantum state [F) = -^J=^ X],res 1^^^)' *• ^-y uniform 
superposition of all the permutations of a given graph F. By 
generating such states for two given graphs, one could then 
use the standard SWAP-test [13] to check whether the two 
states are equal or orthogonal and therefore decide whether 
the graphs are isomorphic or not. Furthermore, it is known 
that all problems in statistical zero knowledge (SZK) can be 
reduced to instances of quantum state generation [4], along 
with gap- versions of closest lattice vector problems [39, 3] 
and subgroup membership problems for arbitrary subgroups 
of finite groups [50, 51, 22]. Aside from brute-force attempts 
that try to solve quantum state preparation by applying 
sequences of controlled rotations (typically of exponential 
length) to fix the amplitudes of the target state one qubit at 
a time, not much is known regarding approaches to tackle 
the quantum state generation problem while exploiting in- 
herent structure. 

In this regard, the only examples we are aware of are (i) a 
direct approach to generate states described by efficiently 
computable amplitudes [25], (ii) an approach via adiabatic 
computing [4] in which a sequence of local Hamiltonians 
has to be found such that the desired target state is the 
ground state of a final Hamiltonian and the overlap between 
intermediate ground states is large, and (iii) recent work on 
quantum analogues of classical annealing processes [10, 45] 
and of the Metropolis sampling procedure [46, 52]. 

Conversely, for some problems a lower bound on the com- 
plexity of solving a corresponding quantum state genera- 
tion problem would be desirable, for instance to provide fur- 
ther evidence for the security of quantum money schemes, 
see e.g. [1, 21]. Unfortunately, except for a recent result 
that generalizes the adversary method to a particular case 
of quantum state generation problems (see [34] and [7]), very 
little is known about lower bounds for quantum state gen- 
eration problems in general. 
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Rejection sampling. 

The classical rejection sampling method^ was introduced 
by von Neumann [49] to solve the following resampling prob- 
lem: given the ability to sample according to some proba- 
bility distribution P, one is asked to produce samples from 
some other distribution S. Conceptually, the method is 
extremely simple and works as follows: let 7 < 1 be the 
largest scaling factor such that 7S lies under P, formally, 
7 = minfc(pfc/sfc). We accept a sample k from P with prob- 
ability ysk/pk, otherwise we reject it and repeat. The ex- 
pected number T of samples from P to produce one sample 
from S is then given by T = I/7 = maxfc(sfc/pfc). See 
also [20] for further details and analysis of the method for 
various special cases of P and S. In a setting where access 
to the distribution P is given by a black box, this has been 
proved to be optimal by Letac [35]. The rejection sampling 
technique is at the core of many randomized algorithms and 
has a wide range of applications, ranging from computer 
science to statistical physics, where it is used for Monte 
Carlo simulations, the most well-known example being the 
Metropolis algorithm [37]. 

In the same way that quantum state preparation can be 
considered a quantum analogue of classical sampling, it is 
natural to study a quantum analogue of the classical resam- 
pling problem, i. e., the problem of sampling from a distri- 
bution S given the ability to sample from another distri- 
bution P. We call this problem quantum resamphng and 
define it to be the following analogue of the classical resam- 
pling problem: given an oracle generating a quantum state 
jTT^) = X]fe=i ''^k\£,k)\k) , where the amplitudes tt^ are known 
but the states j^^) are unknown, the task is to prepare a 
target state \a^) — X]fe=i ''"fclC*)!'^) with (potentially) differ- 
ent amplitudes at but the same states Note that while 
both the initial amplitudes nk and the final amplitudes at 
are fixed and known, the fact that the states are un- 
known makes the problem non-trivial. 

Related work. 

The query complexity of quantum state generation prob- 
lems was studied in [7], where the adversary method was 
extended to this model and used to prove a tight lower 
bound on a specific quantum state generation problem called 
IndexErasure. The adversary method was later extended 
to quantum state conversion problems — where the goal is to 
convert an initial state into a target state — and shown to 
be nearly tight in the bounded error case for any problem 
in this class, which includes as special cases state genera- 
tion and the usual model of function evaluation [34]. In all 
these cases, the input to the problem is classical, as the or- 
acle encodes some hidden classical data. This is where the 
quantum resampling problem differs from those models, as 
in that case the oracle encodes unknown quantum states. 

Grover [24] considered a special case of the quantum re- 
sampling problem, where the initial state [tt) = \x) 
is a uniform superposition and one is given access to an or- 
acle that for given input x provides a classical description 
of ax, the amplitude in the target state \cr} = X^^. o"a;|a;). 
We significantly extend the scope of Grover's technique by 
considering any initial superposition and improving the effi- 



^It is also known as the accept/reject method or "hit-and- 
miss" sampling. 



ciency of the algorithm when only an approximate prepara- 
tion of the target state is required. 

Techniques related to quantum resampling have already 
been used implicitly as a useful primitive for building quan- 
tum algorithms. For instance, it was used in a paper by 
Harrow, Hassidim, and Lloyd [26] for the problem of solving 
a system of linear equations Ax = b, where A is an invert- 
ible matrix over the real or complex numbers whose entries 
are efficiently computable, and 6 is a vector. The quantum 
algorithm in [26] solves the problem of preparing the state 
\x) — A~^\b) by applying the following three basic steps. 
First, use phase estimation on the state |6) = "^^bklipk) 
to prepare the state &fe|Afe)|V'fc), where \ipk) and Aj, de- 
note the eigenstates and eigenvalues of A. Next, convert 
this state to Jlife bis\'^^\Xh)\tpk)- Finally, undo the phase es- 
timation to obtain the target state A~^\b) = fefcA^^lt/ifc). 
The second step of this procedure performs transformation 
J2k^k\Xk)\i^k) n> J2k^k>^k^\^k)\^k) which can be seen as 
an instance of quantum resampling. Note that other works, 
such as [15, 44], have used a similar technique — i.e., using 
phase estimation to simulate some function of an operator — 
to apply a unitary on an unknown quantum state, rather 
than preparing one particular sate. 

The quantum Metropolis sampling algorithm has been 
proposed by Temme et al. [46] to solve the problem of prepar- 
ing the thermal state of a quantum Hamiltonian. As it is 
heavily inspired by the classical Metropolis algorithm, the 
main step uses an accept/reject rule on random moves be- 
tween eigenstates of the Hamiltonian. The main complica- 
tion comes from reverting rejected moves, as the no-cloning 
principle prevents from keeping a copy of the previous eigen- 
state. We will show that this step actually reduces to a 
quantum resampling problem, and that quantum rejection 
sampling leads to an alternative solution which also provides 
a speed-up over the technique proposed in [46]. 

Finally, another type of quantum resampling problem has 
been considered in a paper by Kitaev and Webb [32] in which 
the task is to prepare a superposition of basis states with 
Gaussian-distributed weights along a low-dimensional strip 
inside a high-dimensional space. Authors solve this problem 
by applying a sequence of lattice transformation and phase 
estimation steps. 

For us, another important case in point are hidden shift 
problems over an abelian group A. Here it is easy to prepare 
a quantum state of the form [tt*) = "^^^j^ f{w)X'w{s)\w) , 

where denotes the characters of A and / denotes the 
Fourier transform of / (see e.g., [18, 29, 42]). If we could 
eliminate the Fourier coefficients f{w) from state [tt^), we 
would obtain a state \(t^) = \A\^^^^ '^^^j^X'ui{s)\w) from 
which the hidden shift s can be easily recovered by apply- 
ing another Fourier transform. Note that in this case the 
states \^k) are actually just the complex phases X-ui{s)- We 
will discuss an application of our general framework to the 
special case of hidden shift problems in Sect. 5.3. 

Our results. 

We denote the classical resampling problem mentioned 
above by SamplinGp_»s, where P and S are probability 
distributions on the set [n]. Note that in its simplest form, 
this problem is not meaningful in the context of query com- 
plexity (indeed, if distribution S is known to begin with, 
there is no need to use the ability to sample from P). How- 



ever, there is a natural modification of the problem, that 
actually models realistic applications, which does not suffer 
from this limitation. In this version of the problem, there is 
a function ^ that deterministically associates some unknown 
data with each sample, and the problem is to sample pairs 
where k follows the target distribution. Formally, 
the problem is therefore defined as follows: given oracle ac- 
cess to a black box producing pairs (fc, ^(fc)) £ [n] x [d] such 
that k is distributed according to P, where ^ : [n] — >■ [d] is 
an unknown function, the problem is to produce a sample 
(fc, (,{k)) such that k is distributed according to S. Note that 
in this model it is not possible to produce the required sam- 
ples without using the access to the oracle that produces the 
samples from P, and the algorithm is therefore restricted to 
act as in Fig. 1. 
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Figure 1: Classical rejection sampling: A black box 
produces samples k according to a known probability 
distribution P and accompanied by some unknown 
classical data ^(fc). The algorithm A either accepts 
or rejects these samples, so that accepted samples 
are distributed according to a target distribution S. 

The problem studied in this article is a quantum ana- 
logue of SamplinGp->s, where probability distributions are 
replaced by quantum superpositions. More precisely, let 
■K,cr £ K" be such that \\tv\\2 = Hfjlj = 1 and nk,crk > for 
all k £ [n]. Let O be a unitary that acts on a default state 
|0)d„ G (g) C" as O : |0)d„ ^ |7r«) - ELi '^'=ICfc>|fc>, 
where |^fc) G are some fixed unknown normalized quan- 
tum states. Given oracle access to unitary black boxes 0,0\ 
the QSampling„_j^ problem is to prepare the state \(t^) :— 
Ylk=i '^k\^k)\k). Note that a special case of this problem is 
the scenario d = 1, when £ C are just unknown phases 
(complex numbers of absolute value 1). 

The main result of this article is a tight characterization 
of the query complexity of QSampling„_^^ for any success 
probability p (the vector e^_>o., as well as the probabilities 
Pmin,Pmax, wiU be defined in Sect. 2, intuitively, the vector 
e^-^o- characterizes the amplitudes of the final state pre- 
pared by the best algorithm having success probability p): 



Theorem 1. For p G [pmin,Pmax], the quantum query 
complexity of QSampling„_>^ with success probability p is 
gi_p(QSAMPLlNG„^^) = e(l/||e^^^||2). For p < pmin, 
the query complexity is 1, and for p > pmax, it is infinite. 

Let us note that when p — Pmax ~ 1, the query com- 
plexity reduces to maxfe((Tfe/7rfe) in analogy with the clas- 
sical case, except that amplitudes replace probabilities. The 
lower bound comes from an extension of the automorphism 
principle (originally introduced in the context of the adver- 
sary method [7, 27]) to our framework of quantum state gen- 
eration problems with quantum oracles. The upper bounds 
follows from an algorithm based on amplitude amplification 
that we call quantum rejection sampling. We also show that 
a modification of this algorithm can also solve a quantum 



state conversion problem, which we call strong quantum re- 
sampling (SQSampling). 

Next, we illustrate the technique by providing difTerent ap- 
plications. We first show that the main steps in two recent 
algorithms, namely the quantum algorithm for solving linear 
systems of equations [26] and the quantum Metropolis sam- 
pling algorithm [46], consists in solving quantum state con- 
version problems which we call QLinearEquations^ and 
QMetropolisMovEj;. We then observe that these prob- 
lems reduce to SQSampling, and can therefore be solved 
using quantum rejection sampling. 

Theorem 2. For any k G [1, k], there is a quantum algo- 
rithm that solves QLinearEquations^ with success proba- 
bility p = (lu^ • ii;)/(||u;||2 • ||'i''|l2) using an expected number 
of queries 0{k/ WwW^), where Wj := bj/Xj, Wj := bj/Xj, and 
Xj ;= max{K~^, Aj}. 

Theorem 3. There is a quantum algorithm that solves 
QMetropolisMove^ with success probability 1 using an 
expected number of queries 0{l/\\' 



Let us note that while the quantum algorithm for linear 
systems of equations was indeed using this technique implic- 
itly, this was not the case for quantum Metropolis sampling, 
where quantum rejection sampling provides some speed-up 
over the original algorithm. 

Our final result is an application of quantum rejection 
sampling to the Boolean hidden shift problem BHSP/, de- 
fined as follows. Let / : F2 — >■ F2 be a Boolean function, 
which is assumed to be completely known. Furthermore, we 
are given oracle access to shifted function /s(a;) f{x -f s) 
for some unknown bit string s G F2 , with the promise that 
there exists x such that f{x -\- s) ^ f{^)- The task is to find 
the bit string s. 

We show that we can solve this problem by solving the 
QSampling„_>^ problem for tt corresponding to the Fourier 
spectrum of /, and cr being a uniformly flat vector. This 
leads to the following upper bound which expresses the com- 
plexity of our quantum algorithm for the Boolean hidden 
shift problem in terms of a vector e'^^cr (defined in Sect. 3) 
that can be thought of as a "water-filling" of the Fourier 
spectrum of /: 

Theorem 4. Let f be a Boolean function and f be its 
Fourier transform. For any p, we have (5i_p(BHSP/) = 
0(1/ |le5i-_»o- 112): where components of tt and cr are given by 
T^w = \ fw\ and o-„ = l/\/2" for w G Fj . 

As special cases of this theorem we obtain the quantum al- 
gorithms for hidden shift problem for delta functions, which 
leads to the Grover search algorithm [23] , and for bent func- 
tions, which are functions that have perfectly flat absolute 
values in their Fourier spectrum [42]. In general, the com- 
plexity of the algorithm is limited by the smallest Fourier 
coefficient of the function. By ignoring small Fourier coef- 
ficients, one can decrease the complexity of the algorithm, 
at the cost of a lower success probability. The final success 
probability can nevertheless be amplified using repetitions 
and by constructing a procedure to check a candidate shift, 
which leads to the following theorem. 

Theorem 5. Let f be a Boolean function and f be its 
Fourier transform. Moreover, let p, 7 G [0, 1] be such that 



II e II J — -y2"p, where e-w ~ min{|/u,|, 7/\/2"}. Then, for any 
5>Q,we have ^^(BHSP/) = 0{^{l/ \\e\\^ + l/^/Tf)). 

2. DEFINITION OF THE PROBLEM 

In this section, we define diiTerent notions related to the 
quantum resampling problem. It is important to note that 
this problem goes beyond the usual model of quantum query 
complexity, where the goal is to compute a function depend- 
ing on some unknown classical data that can be accessed 
via an oracle (see [14] for a complete survey). In the usual 
model, the algorithm is therefore quantum but both its in- 
put and output are classical. A first extension of this model 
is the case were the output is also quantum, that is, the goal 
is to generate a target quantum state depending on some 
unknown classical data hidden by the oracle. The quan- 
tum adversary method has recently been extended to this 
model by [7], where is was used to characterize the query 
complexity if a quantum state generation problem called 
IndexErasure. In both the usual model and this exten- 
sion, the oracle acts as Ox ■ \b)\i) i— > \h -\- Xi)\i) , where x is 
the hidden classical data. However, the quantum resampling 
problem corresponds to another extension of these models, 
where the input is also quantum, in the sense that the oracle 
hides unknown quantum states instead of classical data. Let 
us now define this extended model more precisely. 

Definition 1. Let O ~ {Ox : x e X} and * ~ {\ipx) ■ 
X € X}, respectively, be sets of quantum oracles (i. e., uni- 
taries) and target quantum states labeled by elements of 
some set X. Then V ~ (0,4', A") describes the following 
quantum state generation problem: given an oracle Ox for 
some unknown value of x £ X, prepare a state 

W = \/p|V':c)|0) + lerror^c), 

where p is the desired success probability, 1 0) is a normalized 
standard state for some workspace and | error j,) is an arbi- 
trary error state with norm at most y/1 — p. The quantum 
query complexity of V is the minimum number of queries 
to Ox or Ol necessary to solve V with success probability p 
and will be denoted by Q\-p{V). 

Intuitively, we want the final state \%p) to have a compo- 
nent of length at least in the direction of |'0a;)|O). We 
can restate the condition || |errora:) < -^1 — p as follows: 

1 - P > IIIV^) - ^\-^.m\\l = 1 +P- 2Re[{7A| • ^\rpxm] , 
or equivalently; 

Re[{V'|-|^.)|0)] > Vp. (1) 

Note that the main difference of the above definition with 
the usual model of quantum query complexity, and its ex- 
tension to quantum state generation in [7] , is that the oracle 
is not restricted to act as Ox '■ \b)\i) i— >■ |fe + Xi)\i). 

We now formally define QSampling„^^ as a special case 
of quantum state generation problem. Throughout this ar- 
ticle, we fix positive integers d, n and we assume that tt, cr £ 
R" are vectors such that UttHj = ||""||2 = 1 a.nA-Kk,(Tk > for 
all fc G [n]. We also use the notation |7r) := X^^^j 'i^k\k) and 
\cr) :— X]fe=i "^fel^)- For simplicity, we assume that at > 
for all fc £ [n], but the general case can easily be obtained 
by taking the limit (jfc — )■ 0. 

Let ^ = (l^fc) £ : fc £ [n]) be an ordered list of nor- 
malized quantum states. Then any unitary that maps a 



default state \0)dn to |7r^) :— X^JJ^^ 7rfe|^fe)|fc) is a valid or- 
acle for QSampling„_^^. Therefore, we will label valid or- 
acles by a pair {(,,u), where ^ denotes the states hidden 
by the oracle, and u defines how the oracle acts on states 
that are orthogonal to \0)dn- More explicitly, we fix a de- 
fault oracle O £ \J{dn) as a unitary that acts on \0)dn as 
O\0)dn = |0)ti|7r), and arbitrarily on the orthogonal com- 
plement. We then use O as a reference point to define the 
remaining oracles: 

Oe.u-VeOu, (2) 

where it £ U(dn) is a unitary such that u\0)dn ~ \0)dn and 
is a unitary that acts on |0)d|A:) as V5|0)d|fc) = |^fc)|fc) 
for any k £ [n], and arbitrarily on the orthogonal com- 
plement of these states, so that O^^u\0)dn = V^O|0)d„ = 
V«ELi^fc|0)d|fc) = ELi^'=ICfc)|fc> = k^) (note that how 

and are defined on the orthogonal complements is ir- 
relevant as it only affects the exact labeling, but not the set 
of valid oracles). 

Definition 2. The quantum resampling problem, denoted 
by QSampling„^^, is an instance of quantum state gener- 
ation problem (O, ^I", X) with 

:={(?,«): C = (ICi), lU) e (C)", ^ e S}, 

S~{ue \J{dn) : u\0)dn = |0)dn} = U(dn - 1). 

Oracles in O that are hiding the states |7r^) are defined ac- 
cording to Eq. (2) and the corresponding target states are 
defined by |a«) := V^\0)dW) = ELi '^fclCfc)!^)- 

Let us note that the target states only depend on the index 
5, and not u. Moreover, note that amplitudes vr^ and at can 
be assumed to be real and positive without loss of generality, 
as any phase can be corrected using a controUed-phase gate, 
which does not require any oracle call since tt and cr are 
fixed and known. 

In [34], Lee et al. have proposed another extension of the 
query complexity model for quantum state generation of [7] 
by considering quantum state conversion, where the prob- 
lem is now to convert a given quantum state into another 
quantum state, instead of generating a target quantum state 
from scratch. They have extended the adversary method to 
this model and showed that it is approximately tight in the 
bounded-error case for any quantum state conversion prob- 
lem with a classical oracle. Here, we define a model that 
combines both extensions (from classical to quantum ora- 
cles as well as from state generation to state conversion), 
hence subsuming all previous models (see Fig. 2). 

Definition 3. Let O ~ {Ox ■ x £ X}, $ := {\(j>x} : x £ 
X} and 4* := {\4}x) '■ x £ X}, respectively, be sets of quan- 
tum oracles {i. e., unitaries), initial quantum states and tar- 
get quantum states labeled by elements of some set X. Then 
V := {O, $, ^, X) describes the following quantum state con- 
version problem: given an oracle Ox for some unknown value 

01 X £ X and a copy of the corresponding initial state \4'x), 
prepare a state 

1^) =%/p|V^^)|0) +|error,), (3) 

where p is the desired success probability, |0) is a normalized 
standard state for some workspace and [error^;) is an arbi- 
trary error state with norm at most ^1 — p. Again, Qi-p{'P) 
will denote the quantum query complexity of V. 



We also define a strong version of tlie quantum resam- 
pling problem, which is a special case of the state conversion 
problem. Compared to the original resampling problem, it 
is made harder due to two modifications. First, instead of 
being given access to an oracle that maps \0)dn to jTT^), we 
are only provided with one copy of |7r*) and an oracle that 
refiects through it, making this a quantum state conversion 
problem. The second extension assumes that we only know 
the ratios between the amplitudes tta, and at for each k, in- 
stead of the amplitudes themselves. More precisely, instead 
of vectors tt, cr G R" specifying the initial and target am- 
plitudes, we fix a single vector r £ R" such that Tk > 
and maxfc = 1, specifying the ratios between those am- 
plitudes. Let us now formally define the stronger version 
of the quantum resampling problem (this definition is moti- 
vated by the applications that will be presented in Sect. 5.1 
and 5.2). 



Definition 4. Let P — {tt G R" : WnW^ = 1,VA: : ttj, > 
0}. The strong quantum resampling problem SQSampling.^ 
is a quantum state conversion problem (O, $, >1/, X), where 
X ~ {(Ctt) : C = (ICi),.--,l^n)) G (C^r.TT G P}, oracles 
in O are defined by Of,„ :— ref|„{^ = J — 2|7r^)(7r^| with the 

corresponding initial and target states being |7r^) and |cr^) — 
X]fe=i '^k\(,k)\k), respectively, where a := tt o t/ ||7r o t\\^ so 

that (Tfc /TVk OC Tk ■ 
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Figure 2: Comparison of different classes of prob- 
lems in quantum query complexity. The case of 
function evaluation has been extensively studied in 
the literature. The extension to quantum state gen- 
eration with classical oracles, as well as the prob- 
lem IndexErasure which belongs to that class, have 
been studied in [7]. The adversary method has 
been extended to the case of quantum state con- 
version with classical oracles in [34]. The problems 
QSampling^^^ and SQSampling,. studied in this arti- 
cle use quantum oracles and therefore belong to yet 
another extension of the quantum query complexity 
model. 

The relationship between different classes of query com- 
plexity problems introduced above, and strong and regular 
quantum rejection sampling as special instances of them are 
summarized in Fig. 2. Our main result is that the quantum 
query complexities of QSampling„^^ and SQSampling.^ 
for any success probability p depend on a vector e^_>o. de- 
fined as follows. 



Definition 5. For any 7r,cr, let us define the following 



quantities 

Pmin := (O""'' ■ Tt)^, 7min ~ miU {■Kk/(Tk), 

k-.TT^X) 

Pmax := ^ O-fc, 7max max(-7rfc/(Tfc). 

fc:7rfc>0 

For any 7 G [7min,7max], let us define a vector 5(7) and a 
scalar ^(7) by 



£fc(7) ~ min{7rfc,7crfc}, ^(7) ~ 



■ g(7) 
I|e(7)ll2 



For p G [pmin,Pmax], let 7 G [7min , 7max] bc such that p{-y) = 
p and define a vector e^_>a- := 2(7) ■ 

To see that e^_>o. is well-defined, note that |je(7)||2 is 
monotonically increasing with 7, while ^(7) is monotonically 
decreasing with 7. More precisely, for 7 — 7min, the vector 
£(7) has components Ekiy) = 70"fe if ttj; 7^ or zero other- 
wise, and p(7) = Pmax- For 7 = 7max, we have 5(7) = tt and 
Pil) ~ Pmin- Between these extreme cases, ^(7) interpolates 
from pmax to Pmin , which means that for any p G [pmin , Pmax] , 
there exists a value 7 such that ^(7) = p, which uniquely 
defines e^^q.- 

Intuitively, £(7) may be interpreted as a "water-filling" 
vector, where 7 defines the water level, and tt^ defines the 
height of "tank" number fc. As 7 increases from to 7min, we 
have Ekiy) = "fo'k, meaning that all tanks are progressively 
filled proportionally to 7. When 7 > 7min, some tanks are 
filled {ycTk > and cannot hold more water, while others 
continue to get filled. 

3. QUERY COMPLEXITY OF QUANTUM 
RESAMPLING 

Let us first show that e?i-_>a- defines an optimal feasible 
point of a certain semidefinite program (SDP). Afterwards 
we will show that the same SDP characterizes the quantum 
query complexity of QSampling„_^^. 



Lemma 1. Let p G [pmin,Pmax], and e = £^^„. 
the following SDP 

maxAf^oTrM s.t. Vfc : 7r| > Mkk, 

Ti [{a ■ (t'^ - pi) M] > 0. 



Then, 
(4) 



has optimal value 
trix Ad — e ■ . 



J, which is achieved by the rank-1 ma- 



£ — e^_^o., satisfies the constraints in SDP (1) and therefore 
constitutes a feasible point. Therefore, the optimal value 
of (1) is at least TrM = ||e|l2- Secondly, we dualize the 
SDP, and provide a dual-feasible point achieving the same 
objective value. The fact that this objective value is feasible 
for both the primal and the dual then implies that this is 
the optimal value. The details of the proof are given in 
Appendix A. □ 

Next, let us prove that SDP (4) provides a lower bound 
for the QSampling^_^^ problem. In Sect. 4, we wiU also 
show that this lower bound is tight by providing an explicit 
algorithm. 

Let us emphasize the fact that the lower bound cannot 
be obtained from standard methods such as the adversary 



method [5, 27] (which has recently been proved to be tight 
for evaluating functions [40, 41, 34]), nor from its extension 
to quantum state generation problems [7, 34], because in this 
case the oracle is also quantum, in the sense that it encodes 
some unknown quantum state rather than some unknown 
classical data. To prove lower bounds it is useful to exploit 
possible symmetries of the problem. We extend the notion 
of automorphism group [7, 27] to our framework of quantum 
state generation problems: 

Definition 6. We say that G is the automorphism group 
of problem {0,^,X) if: 

1. G acts on X (and thus implicitly also on O as <; : ^ 

2. For any g £ G there is a unitary Ug such that Ug\'(}ix) ~ 
1^9(1:)) for a-U X £ X. 

3. For any given g £ G it is possible to simulate the ora- 
cles Og(a:) for all X £ X, using only a constant number 
of queries to the black box Ox- 

While for the standard model of quantum query complex- 
ity, where the oracle encodes some unknown classical data, 
the automorphism group is restricted to be a permutation 
group and is therefore always finite, in this more general 
framework the automorphism group can be continuous. For 
example, in the case of QSampling^.^^^ it will involve the 
unitary group. Taking such symmetries into account might 
significantly simplify the analysis of algorithms for the cor- 
responding problem and is the key to prove our lower bound. 

Lemma 2. Any quantum algorithm for QSamplinG^_>^ 
withp G [pminjPmax] requires at leastQ{l/ ||e5i--+n-|l2) queries 
to O and O"!". 

Proof. The proof proceeds as follows: we first define a 
subset of oracles that are sufficiently hard to distinguish to 
characterize the query complexity of the problem. Exploit- 
ing the automorphism group of this subset of oracles, we 
then show that any algorithm may be symmetrized in such 
a way that the real part of the amplitudes of the final state 
prepared by the algorithm does not depend on the specific 
oracle it was given. These amplitudes define a vector 7 that 
should satisfy some constraints for the algorithm to have 
success probability p. Moreover, we can use the hybrid ar- 
gument to show that the components of 7 should also satisfy 
some constraints for the algorithm to be able to generate the 
corresponding state in at most T queries. Putting all these 
constraints together in an optimization program, we then 
show that such a vector 7 cannot exist unless T is large 
enough. This optimization program is then shown to be 
equivalent to the semidefinite program in Lemma 1, which 
proves the theorem. 

Let us now give the details of the proof. For given n,a £ 
R", let us choose a subset of oracles O^^o- C O-n^cr that 
are hard to distinguish. We choose the states hidden inside 
oracles to be of the form \^k) = (— 1)^''' |0)d, where phases 
are given by some unknown string x £ ¥2- We also choose 
u so that any oracle in the subset acts trivially on the d- 
dimensional register holding the unknown states. In that 
case, this register is effectively one-dimensional, so we will 
omit it and write (—1)^*= as a relative phase. More precisely, 
we consider a set of oracles 0'^ ,^ :— {Ox,u : x £ F2,u £ S}, 



where 

S--{u£ U(n) : u|0)„ = |0)n} ?^ U(n - 1). (5) 

As in the general case, we define the first oracle Oo,i as a 
unitary that acts on ]0)„ as Oo,/|0)n = !"■), and arbitrarily 
on the orthogonal complement, and we use Oo,i as a refer- 
ence point to define the remaining oracles: 

Ox.u ~ VxOoju, where 14 := ELi i-^T''\k){k\. 
The set of target states is *^ „. := {\cr{x)) : x £ ¥2,u £ 
S} where \a{x)) ~ Vx\<t) = 'ELi(-l)"'°'^fel'=)- For the 
quantum state generation problem corresponding to the re- 
stricted set of oracles 0^,0-, the automorphism group is 
G = Fa X U(n — 1) and it acts on itself, i. e., X ^ G. Note 
that the target states depend only on x, but u is used for 
parameterizing the oracles. Intuitively, the reason we need 
this parameter is that the algorithm should not depend on 
how the black box acts on states other than |0)n (or how 
its inverse acts on states other than |7r*)). To make this 
intuition formal, we will later choose the parameter u for 
different oracles adversarially. 

Let us consider an algorithm that uses T queries to the 
black box Ox,u and its inverse, and let us denote the final 
state of this algorithm by \tpT{x,u)) . If we expand the first 
register in the standard basis, we can express this state as 

IVT(x,u)) = ELi(-i)"Nfc>!7fe(^,w)). 

Here the workspace vectors |7fc(a;,ii)) can have arbitrary di- 
mension and are not necessarily unit vectors, but instead 
satisfy the normalization constraint Efc=i II l7fe(^i '^)) II2 = 1- 
If the algorithm succeeds with probability p, then according 
to Eq. (1) for any x and u we have 

^< Re[{o-(x)l(Oi ■ \i^T{x,u)}] 
= ■ 7(2;, u), 

where 7(2;, u) is a real vector whose components are given 
by 

jk{x,u) ~ Re[(0i7fc(x,it))]. 

Note that ||7(x,it)]|2 < 1. 

Next, let us show that we can symmetrize the algorithm 
without decreasing its success probability. We do this by 
replacing each oracle call by Ox+y,uv = VyOx,uV and cor- 
recting the final state by applying Vj (see Fig. 3). Let fi be 
the Haar measure on the set S defined in Eq. (5). We define 
an operation that symmetrizes a set of states: 



|<^(a;,it)):= 




If we symmetrize the final state |i/'T(a;, «)), we get 

\lpTix,u)) = 

1 r " 

7=E / E(-i)''l^)l^^(^ + J/'™)>ly)l^>dM(«). 

Note that the target state \a{x)}\0) is already symmetric, 
so symmetrization only introduces an additional workspace 
register in a default state (uniform superposition): 
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Figure 3: Symmetrized algorithm. We symmetrize the algorithm by introducing unitaries Vy and v, controlled 
by an extra register prepared in the uniform superposition over all \y) and I?;). 



The success probability of the symmetrized algorithm is 
^/p — Re [(o-(x-)l(Ol ■ |^T(a^,M))] 
" 1 f - 



T - 
= er -7, 



where, by changing variables, we get that 7 is the average 
of vectors 7(2/, v) and thus does not depend on x and u: 



1 



2" ' 



7(1/, I;) d[i(v) 



Note that II7II2 < 1 by triangle inequality. Also, note that 
p > p, since the mean is at least as large as the minimum. 
Thus without loss of generality we can consider only sym- 
metrized algorithms. 

Let X, x' G F2 and u, u £ S. The difference of final states 
of the symmetrized algorithm that uses oracles Ox,u and 
Oi!',ii' is given in Eq. (10) on the next page. By the hybrid 
argument [8, 48], we get the following upper bound:^ 



Mt{x,u)) ■ 



\'<Pt{x' ,u'))\\ <T-\\Ox,u 
II2 



(6) 



where denotes the usual operator norm. Bounds (10) 

and (6) together imply that for any x, x' G F2 and u, u G S: 



T > 



Ox,u Ox' ,u' II 



(7) 



To obtain a good lower bound, we want to choose oracles 
Ox,u and Ox\u' to be as similar as possible. First, let us 
fix u := I, X := G and x' := ei, where e; is the l-th stan- 
dard basis vector. Then, the numerator in Eq. (7) is simply 
27; . Let us choose u' in order to minimize the denominator. 
Recall that Oo,i|0)ri = Itt) and note that any unitary ma- 
trix that fixes |7r) can be written as Oo,7w'(Oo,j)^ for some 
choice of u' fixing |0)„. Since Oxi,u'\^)n ~ V'e, Oo,/w'|0)„ — 
Vei|7r), we also have Oi,',^' (Oo,/)^|7r) — 14j|7r), and any 
unitary matrix that sends |7r) to Ve, Itt) can be expressed 

^It follows by induction from the following fact. If O and 
O' are unitary matrices, then for any vectors |7/>) and it 
holds that 



01- 



■ o'\^')\\., = IIOIV') - o'lV-) + o'\ip) - oV) 



< ||(0-0')|^)||2 + 

<\\o-o'\\ + 



|0'(|^)-|^'))||2 



as Ox\u'{Oojy for some choice of u' . Let us choose u' so 
that Oa;',„' (Oo,j)^ acts as a rotation in the two-dimensional 
subspace span{|7r), Ve, |7r)} and as identity on the orthog- 
onal complement. If 9 denotes the angle of this rotation, 
then cos 6' = {7r|Ve, |7r) — X]*=i ^ ^vrf = 1 — 27rf and 
sin 6 = ^1 - (1 - 27r2)2 = 2iti ^\ - nf. Then 



= I 



'(Oo,. 



/ cos 9 
\sin9 



— sin 6* 
cos 9 



where the singular values of the last matrix are equal to 1, 
since it is a rotation. By plugging this back in Eq. (7), we 
get that for any I £ [n]: 



T > 



Thus any quantum algorithm that solves QSampling^_>^ 
with T queries and success probability p gives us some vector 
7 such that 



II7II2 < 1. o-"^-7>Vp. 



<T7vi. 



(8) 



To obtain a lower bound on T, we have to find the smallest 
possible t such that there is still a feasible value of 7 that 
satisfies Eqs. (8) (with T replaced by t). We can state this 
as an optimization problem: 



s.t. 



1171 
V/ : 

T 



I2 < 1. 

l7i| < t^i, 
■ 7 > VP- 



(9) 



Finally, let us show that we can start with a feasible solu- 
tion 7 of problem (9) and modify its components, without 
increasing the objective value or violating any of the con- 
straints, so that VZ : 7i > and II7II2 ~ 1- Clearly, making 
all components of 7 non-negative does not affect the objec- 
tive value and makes the last constraint only easier to satisfy 
since at > for all k. To turn 7 into a unit vector, first 
observe that not all of the constraints 7; < tni can be satu- 
rated (indeed, in that case we would have — tTT with t < 1 



smce II7II2 < 



1, but the last constraint then implies 



a ■ TT > yjp, which contradicts the assumption p > Pmin). 
If II7II2 f' j such that 7j < t-Kj. We increase 7^- 



until either ||7|| 



1 or 7j = tiTj. We then repeat with 



another j such that 7-, < t-Kj, until we reach II7II2 ~ 1- Note 



Mt{x,u)) - \x}jt(x' ,u'))\ 



" 1 /■ 

Y.^Y. / \k){{-lY''\lk{x + y,uv))-{-lY'^\^^{x' + y,u'v)))\y)\v)dt,{v) 
fc^i V^" j,gp„ Jves 



= EiE / ||(-i)^l7fe(^ + y,H>-(-irH7.(^' + y,"^))|r d^W 

fc=i yeFj^^^e^^" 

"if , 

/ {{-lY''lk{x + y,uv)-{-lY>"yk{x +y,uv)f dii(v) 

k = l yeFy"'"6'S' 



fc=l fciXfcT^l'j. 

Here the two inequalities were obtained from the following facts: 

1. If |0) is a unit vector then for any I7) we have: ||l7)||2 > || 10) (OI7) = \{0\'y}\'^ > (Rc[(0l7)])^ 

2. For any function "f[y,v) by Cauchy-Schwarz inequality we have: 



(10) 



that while doing so, the other constraints remain satisfied. 
Therefore, the program reduces to 

T > min^. f s.t. 117112 = 1, 

: < 7, < tTTi, 

o-^ ■ 7 > VP- 
Note that we need p < Pmax, otherwise this program has no 
feasible point. Setting e — 'f/t,we may rewrite this program 
as in Eq. (22) in Appendix A: 

^ < max£^>o ||e||2 s.t. Vfc : ttj; > > 0, 

cr^ ■e> ^\\£\\2 , 

Finally, setting M = e • e^, this program becomes the same 
as the SDP in Eq. (4) , with the additional constraint that M 
is rank-1. However, we know from Lemma 1 that the SDP 
in Eq. (4) admits a rank-1 optimal point, therefore adding 
this constraint does not modify the objective value, which 
is also lle^^n-llj by Lemma 1. □ 

4. QUANTUM REJECTION SAMPLING 
ALGORITHM 

In this section, we describe quantum rejection sampling al- 
gorithms for QSampling„_>^ and SQSampling.^ problems. 
We also explain the intuition behind our method and its re- 
lation to the classical rejection sampling. Our algorithms 
are based on amplitude amplification [12] and can be seen 
as an extension of the algorithm in [24] . 

4.1 Intuitive description of the algorithm 

The workspace of our algorithm is C''®C"®C'^, where the 
last register can be interpreted as a quantum coin that de- 
termines whether a sample will be rejected or accepted (this 
corresponds to basis states |0) and |1), respectively). Our 
algorithm is parametrized by a vector e £ R" (0 < Efc < 
for all k) that characterizes how much of the amplitude from 
the initial state will be used for creating the final state (in 
classical rejection sampling e| corresponds to the probability 



that a specific value of k is drawn from the initial distribu- 
tion and accepted). 

We start in the initial state |0)d|O),i|O) and apply the or- 
acle O to prepare [tt^) in the first two registers: 

n 

O|0)d„®|0) = |7r«)|0) =^7rfciefc)|fc)10). (U) 
fc=i 

Next, for each k let Re{k) be a singie-qubit unitary operation 
defined'' as follows (this is a rotation by an angle whose sine 
is equal to ek/i^k)'- 

- - f ^^^^^ _£^y (12) 

Let Rg :— X^fe^i ® Re{k) be a block-diagonal matrix 

that performs rotations by different angles in mutually or- 
thogonal subspaces. Then Id ® Re corresponds to applying 
Re{k) on the last qubit, controlled on the value of the sec- 
ond register being equal to k. This operation transforms 
state (11) into 

1*.) ~ (/d®i?c)- |7r«)|0) 

n 

= Y.\^k)\k}[^\n,\^-el\0}+e,\l)). (13) 

k=l 

If we would measure the coin register of state in the 
basis {jo), |1)}, the probability of outcome |1) ("accept") and 
the corresponding post-measurement state would be 

n 

q. ~ ||(7d®/n®|l)(l|)|*.)||2 = Ml, (14) 

fc = l 

n 

|*n,.) := ^;^efc|S.)|fc)|l). 



^For those fc, for which TTfe — 0, operation Rsik) can be 
defined arbitrarily. 



Note that if the vector of amphtudes e is chosen to be close 
to <T, then the reduced state on the first two registers of 
l^'n.e} has a large overlap on the target state |cr^), more 
precisely, 



((a«l®{l|)|*n,.) 



(15) 



Depending on the choice of e, this can be a reasonably good 
approximation, so our strategy will be to prepare a state 
close to l^'n.e)- 

In principle, we could obtain j^&n.e) by repeatedly prepar- 
ing |\E'e) and measuring its coin register until we get the 
outcome "accept" (we would succeed with high probability 
after 0{l/qe) steps). To speed up this process, we can use 
amplitude amplification [12] to amplify the amplitude of the 
"accept" state |1) in the coin register of the state in Eq. (13). 
This allows us to increase the probability of outcome "ac- 
cept" arbitrarily close to 1 in 0(l/y^) steps. 



4.2 



Amplitude amplification subroutine and 
quantum rejection sampling algorithm 



|0)d- 
|0)n- 

|0)2- 



o 



Figure 4: Quantum circuit for implementing Ue. 

We will use the following amplitude amplification subrou- 
tine extensively in all algorithms presented in this paper; 

'SQRs(ref|„5)|o),e,t) := (ref|a,^) ■ ref/^0/^0|i)(i|)*, 

where reflections through the two subspaces are defined as 
follows: 

i'ef/^<8)/„<8|i>(il := Id® In® {h - 2|1){1|) = Id ® /„ ® Z, 

ref|*,) := {h ® Re) ref|„5)|o^ {h ® Re)'' ■ 

Depending on the application, we will either be given an 
oracle O for preparing |7r^)|0) or an oracle refj^j^jQ^ for re- 
flecting through this state. Note that we can always use the 
preparation oracle to implement the reflection refj^j^iQ^ as 



(0®/2 



>/2-2|0,0,0)(0,0,0j) (0®/2)^ (16) 



Amplitude amplification subroutine 'SQRs(ref |^{^|q^ , £, t) 
for quantum rejection sampling 

Perform the following steps t times: 

1. Perform T^<^fij^i,^^\i){i\ by applying Pauli Z on the coin 
register. 

2. Perform ref|^^^ by applying on the last two registers, 
applying ref|^4^|g^, and then undoing Re- 



The quantum rejection sampling algorithm .4qrs(0, tt, e) 
starts with the initial state |0)d|0)nlO). First, we trans- 
form it into I'^e) defined in Eq. (13), by applying Ue — 
{Id ® Re) ■ (O ® h) (see Fig. 4). Then we apply the am- 
plitude amplification subroutine iSQRs(i'ef |,r« >|o) ' ^) with 
t = 0(1/ II e II 2). Finally, we measure the last register: if 



the outcome is |1), we output the first two registers, oth- 
erwise we output "Fail". To prevent the outcome "Fail" we 
can slightly adjust the angle of rotation in amplitude am- 
plification so that the target state is reached exactly. More 
precisely, we prove that one can choose e — r ■ e^^„ for 
some bounded constant r, so that amplitude amplification 
succeeds with probability 1 (i e., the outcome of the final 
measurement is always |1)). Moreover, such algorithm is 
optimal as its cost matches the lower bound in Lemma 2. 



Quantum rejection sampling algorithm ^QRs(0,7r,e) 

1. Start in initial state |0)d|0)n|0>. 

2. Apply f/e. 

3. On the current state apply the amplitude amplification 
subroutine 'SQRs(ref 1^5^ , e, t) where ref|„5^|Q^ is im- 
plemented according to Eq. (16) and t = 0(1/ ||e||2)- 

4. Measure the last register. If the outcome is |1}, output 
the first two registers, otherwise output "Fail". 



Lemma 3. For any pmin < p < Pmax, there is a constant 
r € [|,1], so that the algorithm AQRs{0,i^,e) with e = 
r ■ e^_>cr solves QSampling„_^^ with success probability p 
using 0(l/ \\e^_^^\\2) queries to O and . 

Proof. By Def. 5, we have < £fc < iTk for all k, there- 
fore e^^o- is a valid choice of vector e for the algorithm. 
Instead of using e^_>o. itself, we slightly scale it down by 
a factor r so that the amplitude amplification never fails. 
Note that if we were to use e = e^^^., the probability that 
the amplitude amplification succeeds after t steps would be 
sin^((2t-f 1)6^), where 9 ~ arcsin ||e^_>o.||2 (see e. g. [11, 12] 
for details). Note that this probability would be equal to 
one at t = fg ^ \, which in general might not be an in- 
teger. However, following an idea from [12, p. 10], we can 

where 



2(2t+l) 



ensure this by slightly decreasing 6 to 6 
t :— \jg — |] . This can be done by setting e :— r ■ e^^^. 
with the scaling-down factor r := One can check that 

r satisfles 5 < r < 1 (this follows from < < ^). 

Together with Eq. (15), Def. 5 also implies that for this 
choice, the algorithm solves QSampling„_^^ with success 

probability — y ^ "~||°" = It therefore remains to 

prove that the cost of the algorithm is 0(l/||e||2), which 
follows immediately from its description: we need one query 
to implement the operation Ue and two queries to imple- 
ment ref|„e^|o), thus in total we need 2t + 1 = 0(l/y^) = 
0(1/ ||e||2) calls to oracles O and . □ 

We now have all the elements to prove Theorem 1. 

Theorem 1. For p G [j3min,Pmax], the quantum query 
complexity of QSampling.^^^ with success probability p is 
gi_p(QSAMPLlNG„_,„) = e(l/||e*;^^||2). For p < pmin, 
the query complexity is 1, and for p > pmax, it is infinite. 

Proof. When p < Pmin, the state |7r*) is already close 
enough to |cr^) to satisfy the constraint on the success prob- 
ability, therefore one call to O is sufficient, which is clearly 
optimal. When p > Pmax, the oracle gives no information 
about some of the unknown states \^k) (when nk =0), but 
the target state should have some overlap on |^fe)|A;) to sat- 
isfy the constraint on the success probability, therefore the 
problem is not solvable. 



For the general case Pmin < p < Pmax, the upper bound 
comes from the algorithm in Lemma 3, and the matching 
lower bound is given in Lemma 2. □ 

4.3 Strong quantum rejection sampling algo- 
rithm 

Let us now describe how the algorithm can be modified to 
solve the stronger problem SQSampling.^. The first mod- 
ification follows from the observation that in the previous 
algorithm, the oracle is only used in two different ways: it is 
used once to create the state |7r^), and then only to refiect 
through that state. This means that we can still solve the 
problem if, instead of being given access to an oracle that 
maps |0)d„ to |7r«), we are provided with one copy of |7r^) 
and an oracle that reflects through it. 

In order to solve SQSampling.^, we should also be able 
to deal with the case where we only know the ratios between 
the amplitudes nk and at for each k, instead of the ampli- 
tudes themselves. As we will see, in that case we cannot 
use the algorithm given above anymore, as we do not know 
in advance how many steps of amplitude amplification are 
required. There are different approaches to solve this is- 
sue, one of them being to estimate g^, and therefore the 
required number of steps, by performing a phase estimation 
on the amplitude amplification operator (this is sometimes 
referred to as amplitude estimation or quantum counting, 
see [11, 12]). Another option, also proposed by [11, 12], 
is to repeat the algorithm successively with an increasing 
number of steps until it succeeds. One advantage of the first 
option would be that it provides an estimation of the initial 
acceptance probability g^, which might be useful for some 
applications. Since this is not required for SQSampling.^, 
we will rather describe an algorithm based on the second 
option, as it is more direct. Note that for both options, 
we need to adapt the algorithms in [11, 12] as they require 
to use a fresh copy of the initial state after each failed at- 
tempt, whereas for SQSampling.^ we only have one copy of 
that state. This issue can be solved by using the state left 
over from the previous unsuccessful measurement instead of 
a fresh copy of the state. More precisely, we can use the 
following algorithm. 



Lemma 4. For any a > 1, there is a quantum algorithm 
that solves SQSampling^ with success probability p{'y) usmg 
an expected number of queries 0(1/ |je(7)|j2), where 7 = 
a IItt o T II J. In particular, for a = 1 the expected number of 
queries is 0(1/ ||7r o rHj) and the success probability is equal 
to one. 



Here the parameter a allows us to control the trade-off be- 
tween the success probability and the required number of 
queries. However, we cannot predict the actual values of 
both quantities, because they depend on tt and t, but only 
T is known to us. The only exception is a = 1, when the 
success probability is equal to one. Also, increasing a above 
l/(minfc:Tfc>o Tfc) will no longer affect the query complexity 
and success probability of the algorithm. 

Proof. We show that for some choice of c > 1 and e 
the algorithm ^sQRsd""*), e, c) described above solves the 
problem. 

Let us first verify that we can actually perform all steps re- 
quired in the algorithm. We need one copy of the state [tt^), 
which is indeed provided as an input for the SQSampling^. 
problem. Note that for applying Re in Step 1 it suffices to 
know only the ratio Ek/TTk (see Eq. (12)), which can be de- 
duced from Tfc as follows. Let e :— r ■ £(7) for some r < 1, 
and recall from Def. 5 and 4 that £^(7) = min{7rfe,7CTfe} and 
— TTfeTfe/ IItt o tIIj, respectively. Then 

— — r mmjl, 7 — } 

= rmm{l,7^ — } 

= rmin{l,arfc}, (17) 

where we substituted 7 — a\\Tr o tW^ from the statement 
of the Lemma. Note that once r is chosen, the final ex- 
pression in Eq. (17) is completely known. Finally, applying 
5QRs(ref |„5^IQ^ ,e,t) in Step 4 also requires the ability to ap- 
ply Re, as well as ref|.^e^jQ^ , which can be done by using one 
oracle query. Therefore, we have all we need to implement 
the algorithm. 

We now show that the algorithm has success probability 
p(7). Recall from Eq. (13) that Step 1 of the algorithm 
prepares the state 

n 

|*.)=ElC.)|fc)(/k^^^|0)+e.|l)) 
fe=i 

= sin6»|*n,E) +cos6'|1'n,^), 
where 9 := arcsin WeW^ and unit vectors 

1 " 

sm 6 ^ — ' 

fe=i 

n 

are orthogonal and span a 2-dimensional subspace. In this 
subspace ref/^0/„0|i)(i| and refj^j^ ^) act in the same way, 
so each iteration of the amplitude amplification subroutine 
consists of a product of two reflections that preserve this 
subspace, and 5QR,s(ref [„5^|q^ , e, t) corresponds to a rotation 
by angle 2td. Measurements in Steps 2 and 5 either project 
on l^n.e), when the outcome is |1), or on l^^n^e), when the 
outcome is |0). Therefore, the algorithm always outputs the 
first two registers of the state |^'n,e), and by Eq. (15), the 
success probability is pe = p(7), as claimed. In particular, 
for a = 1 from Eq. (17) we get £k = rnkTk as Tk < 1. 
Thus, e — r{n o r) and since er = (tt o r)/ [[tt o tW^, we get 
Pe = {^^-e/\\e\\,f^l. 

Let us now bound the expected number of oracle queries. 
We follow the proof of Theorem 3 in [12] , but there is an im- 



Strong quantum rejection sampling algorithm 

^SQRs(k^>,£,c) 

1. Append an extra qubit prepared in the state |0) to the 
input state [tt^), and apply on the resulting state. 

2. Measure the last register of the current state. If the out- 
come is output the first two registers and stop. Oth- 
erwise, set I = and continue. 

3. Let T; := [c'] and pick an integer t £ [T;] uniformly at 
random. 

4. On the current state apply the amplitude amplification 
subroutine cSgRsCref |o) , e, *)• 

5. Measure the last register of the current state. If the out- 
come is output the first two registers and stop. Oth- 
erwise, increase I by one and go back to Step 3. 



portant difference: a direct analogue of the algorithm in [12, 
Theorem 3] would use a fresh copy of |7r^) each time the 
measurement fails to give a successful outcome, whereas in 
this algorithm we start from the state left over from the 
previous measurement, since we only have one copy of |7r*). 
Note that 5QRs(ref|„!;^|Q^ , e, t) in Step 4 is always applied on 
l^n,e)i since it is the post-measurement state corresponding 
to the unsuccessful outcome. Therefore, the state created by 
Step 4 is sin(2f6')|*n,e) + cos(2t6')|*n.e), and the next mea- 
surement will succeed with probability sin'^{2td). Since t is 
picked uniformly at random between 1 and T; , the probabil- 
ity that the Z-th measurement fails is 



1 1 

- H cos(4t6l) 

2 2Ti^ ^ ' 



1 1 

- 2 + 27rN^' 

where the upper bound is obtained as follows: 



^cos(4te) ^Refe'^^^e' 



1 - e'"' " 
1 - e'-io 



„-i2Te A2TB 

i2(T+i)e e ~ e 



(18) 



= Re|^e" 
= Re ( e 



- sin(26') - sine 



where we forced the last inequality by picking r :— \/3/2, 
so that sin 6 = 

Iklla < \/3/2 and thus <e < tt/3. Recall 
from the algorithm that Ti = [c'] for some c > 1, so it 
is increasing and goes to infinity as / increases. Let T : — 
1/(2A llellj) for some A > and let Ihe the smallest integer 
such that Ti >T for all I > I. Then according to Eq. (18) 
we get that pi < 1/2 -I- l/(2r WeW^) = 1/2 + A =: p for all 
I > I. Note that the l-th execution of the subroutine uses 
at most 2Ti oracle queries, so the expected number of oracle 
calls is at most 210 + Poi2Ti + pi{2T2 + . . .)). This can be 
upper bounded by 



Y.2TI + Y, 2Tj^,p'' = ^ 2 [c'l + 2 [c'+'^l/ 



i = d=l 



i=0 d=l 
/ I oo 

<4K]c'+/^(cp)' 

\!=0 d=l 

c — 1 1 — cp 



(19) 



< 4c 



1 



P 



2c' 



A Hell 



c — 1 1 — cp 



+ 



c — 1 1 — cp 



(20) 



where the first and last inequality is obtained from the fol- 
lowing two observations, respectively: 

1. [c'l = c' + 5 for some < <5 < 1, so T; = [c'] < c'-M < 
2c' as c> 1. 

2. c'+i < c^\c'-^^ = c^T,.! < c^f = cV(2A||e||2) by 
the choice of I. 

Finally, we have to make a choice of c > 1 and A > 0, so 
that the geometric series in Eq. (19) converges, i. e., cp < 1 
or equivalently c < 2/(1 -I- 2A). By choosing c :— 8/7 and 
A :— 1/4 we minimize the upper bound in Eq. (20) and 
obtain 128/ HeHj = 0(1/ ||e(7)||2). In particular, for a — 1 
this becomes 0(1/ IItt o rllj). □ 

5. APPLICATIONS 

5.1 Linear systems of equations 

As a first example of application, we show that quantum 
rejection sampling was implicitly used in the quantum algo- 
rithm for linear systems of equations proposed by Harrow, 
Hassidim, and Lloyd [26]. This algorithm solves the follow- 
ing quantum state generation problem: given the classical 
description of an invertible dx d matrix A and a unit vector 
\b) £ C*, prepare the quantum state \x) / |||2;)||2, where \x) 
is the solution of the linear system of equations A\x) = \b). 
As shown in [26], we can assume without loss of generality 
that A is Hermitian. Similarly to classical matrix inversion 
algorithms, an important factor of the performance of the 
algorithm is the condition number k of A, which is the ra- 
tio between the largest and smallest eigenvalue of A. We 
will assume that all eigenvalues of A are between and 
1, and we denote by [t/jj) and Xj the eigenvectors and eigen- 
values of A, respectively. We also define* the amplitudes 
bj := (t/ijlb), so that \b) = Y^j^i^jl^i) ■ Then, the problem 
is to prepare the state |a;) := A^^\b) = X]j=i ^i^J^l^i) (^P 
to normalization). 

We now show how this problem reduces to the quantum 
state conversion problem SQSampling^. Since A is Hermi- 
tian, we can use Hamiltonian simulation techniques [9, 15, 
16] to simulate the unitary operator e*'** on any state. Using 
quantum phase estimation [31, 17] on the operator e''**, we 
can implement an operator Ea that acts in the eigenbasis 
of A as Ea : |V'j)|0) where \Xj) is a quantum 

state encoding an approximation of the eigenvalue Xj . Here, 
we will assume that this can be done exactly, that is, we 
assume that |Aj) is a computational basis state that exactly 
encodes Xj (we refer the reader to [26] for a detailed anal- 
ysis of the error introduced by this approximation) . Under 
this assumption, the problem reduces to a quantum state 
conversion problem that we will call QLinearEquations^. 
Its definition requires fixing a set of possible eigenvalues 
Ak C 1] of finite cardinality n := |Ak|. Let us de- 

note the set of d X d Hermitian matrices by Herm(d) and 
the eigenvalues of A by spec(y4). 

Definition 7. QLinearEquations^, the quantum linear 
system of equations problem is a quantum state conversion 
problem {0,^,<S>,X) with X := {{\b),A) G x Herm(d) : 
spec(y4) £ AjJ}, oracles in O being pairs {0\t),A, Ea) where 

*We choose the global phase of each eigenvector \ipj) so that 
bj is real and non-negative. 



SQSampling^ 


QLinearEquations^ 


\k) 














fej if A = Xj G spec(A) 




^0 if A ^ spec(yl) 


16) 
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[tpj) if A = Xj e spec(A) 
n/a if A ^ spec(j4) 


Tk 






TA := {nX)-^ 



Table 1: Reduction from Step 2 in the linear system 
of equations algorithm to the quantum resampling 
problem SQSampling^. 

0|(,)_A ■= ref|j,) and Ea acts as Ea ■ |V'j)|0)„ i-^ 

where are the eigenvectors of A, and the corresponding 

initial and target states being \b) and A^^lb)/ \\A~''''\b)\\^. 

Using Lemma 4 we can prove the following result. 

Theorem 2. For any k G [1, n], there is a quantum algo- 
rithm that solves QLinearEquations^ with success proba- 
bility p = {w^ ■ w) /(lliollj • ||ti^||2) using an expected number 
of queries 0(k/ HujUj), where Wj :— bj/Xj, Wj := bj/Xj, and 
Xj := max{K~^, Aj}. 

Proof. Following [26], the algorithm for this problem 
consists of three steps: 

1. Apply the phase estimation operation Ea on \b) to 
obtain the state X]j=i ■ 

2. Convert this state to Il''''ll2- 

3. Undo the phase estimation operation Ea to obtain the 
target state X^^^i '^jlV'j)/ Il''^ll2- 

We see that Step 2 is an instance of SQSampling.^, where 
the basis states {|A) : AG A„} of the phase estimation reg- 
ister play the role of the states |A:) and the vector r of the 
ratios between the initial and final amplitudes is given by 
Tx := (kA)~^ (here the normalization factor k is to make 
sure that maxA ta = 1). The rest of the reduction is sum- 
marized in Table 1. Therefore, we can use the algorithm 
from Lemma 4 to perform Step 2. 

If we set a ~ hi/k then from Table 1 we get 

(7) = "^Aj min{l, otTx- } 
= &j min{l, (kAj)"^} 

Kmax{K~^, Xj} 

Hi 

thus £(7) = w/k and the expected number of queries is 
0(1/ |le(7)||2) = 0{k/ ||io||2). Recall that the amplitudes 
of the target state are given by Gj = to^ / ||iy||2, so a — 
w/ \\w\\2 and the success probability is 

_ f cr^ ■ £(7) \^ _ ■"^^ '"^ 
as claimed. □ 



Note that even though we have a freedom to choose k, we 
cannot predict the query complexity in advance, since it de- 
pends on Wj = {tl^j \b}/Xj, which in turn is determined by the 
lengths of projections of j6) in the eigenspaces of A, weighted 
by the corresponding truncated eigenvalues A^. Similarly, 
we cannot predict the success probability p. However, by 
choosing k = k we can at least make sure that p = 1 (since 
Xj — Xj and thus w — w). In this case Step 2 is performed 
exactly (assuming an ideal phase estimation black box) and 
the expected number of queries is 0(k/ ||kj||2). By noting 
that Xj < 1 for all j, we see that ||iy||2 = X]j=i — ^ 

and thus we can put a cruder upper bound of 0(k), which 
coincides with the bound given in [26] for that step of the al- 
gorithm. For ill-conditioned matrices, i. e., matrices with a 
high condition number k, the approach taken by [26] is to ig- 
nore small eigenvalues A j < ft for some cut-off ft" ^ > 
which reduces the cost of the algorithm to 0{k), but intro- 
duces some extra error. In our case, by choosing a — n/k 
we obtained bound 0(k/ Hiullg), where ||'iy||2 > 1- Again, 
here w depends on additional structure of the problem and 
cannot be predicted beforehand. 

In practical applications, we will of course not be given 
access to the ideal phase estimation operator Ea, but we 
can still approximate it by using the phase estimation al- 
gorithm [31, 17] on the operator A. It is shown in [26] 
that if A is s-sparse, this approximation can be implemented 
with sufficient accuracy at a cost 0(log{d)s^k/e) , where e is 
the overall additive error introduced by this approximation 
throughout the algorithm. Therefore, the total cost of the 
algorithm is at most 0(log(d)s^K^/e) (see [26] for details). 

5.2 Quantum IMetropolis sampling 

Since rejection sampling lies at the core of the (classical) 
Metropolis algorithm, it seems natural to use quantum re- 
jection sampling to solve the corresponding problem in the 
quantum case. The quantum Metropolis sampling algorithm 
presented in [46] follows the same lines as the classical al- 
gorithm by setting up a (classical) random walk between 
eigenstates of the Hamiltonian, where each move is either 
accepted or rejected depending on the value of some ran- 
dom coin. The main complication compared to the classi- 
cal version comes from the case where the move has to be 
rejected, since we cannot keep a copy of the previous eigen- 
state due to the no-cloning theorem. The solution proposed 
by Temme et al. [46] is to use an unwinding technique based 
on successive measurements to revert to the original state. 
Here, we show that quantum rejection sampling can be used 
to avoid this step, as it allows to amplify the amplitude of 
the "accept" state of the coin register, effectively eliminat- 
ing rejected moves. This yields a more efficient algorithm as 
it eliminates the cost of reverting rejected moves and pro- 
vides a quadratic speed-up on the overall cost of obtaining 
an accepted move.^ 

Before describing in more details how quantum rejection 
sampling can be used to design a new quantum Metropolis 
algorithm, let us recall how the standard (classical) Metropo- 
lis algorithm works [37]. The goal is to solve the following 
problem: given a classical Hamiltonian associating energies 

^Martin Schwarz has pointed out to us that this is similar 
to how [38] provides a speed-up over [36] , and that our tech- 
nique can also be used to speed-up the quantum algorithm 
in [43] for preparing PEPS. 



Ej to a set of possible configurations j, sample from the 
Gibbs distribution p{j) = exp{— f3Ej) / Z (fi) , where P is the 
inverse temperature and Z{P) = exp{—PEj) is the par- 
tition function. Since the size of the configuration space is 
exponential in the number of particles, estimating the Gibbs 
distribution itself is not an option, therefore the Metropo- 
lis algorithm proposes to solve this problem by setting up 
a random walk on the set of configurations that converges 
to the Gibbs distribution. More precisely, the random walk 
works as follows; 

1. If j is the current configuration with energy Ei, choose 
a random move to another configuration j {e. g., for a 
system of spins, a random move could consist in flip- 
ping a random spin), and compute the associated en- 
ergy Ej. 

2. The random move is then accepted or rejected accord- 
ing to the following rule: 



if Ej < Ei. 
if Ei > E, 



then the move is always accepted; 
then the move is only accepted with 



probability exp(/3(£'i — Ej)). 

It can be shown that this random walk converges to the 
Gibbs distribution. 

The quantum Metropolis sampling algorithm by Temme et 
al. [46] follows the same general lines as the classical al- 
gorithm. It aims at solving the equivalent problem in the 
quantum case, where we need to generate the thermal state 
of a Hamiltonian H, that is, we need to generate a random 
eigenstate \tf}j) where j is sampled according to the Gibbs 
distribution. The fact that the Hamiltonian is quantum, 
however, adds a few obstacles, since the set of eigenstates 
\ipj) is not known to start with. The main tool to overcome 
this difficulty is to use quantum phase estimation [31, 17] 
which, applied on the Hamiltonian H, allows to project any 
state on an eigenstate {ipj), while obtaining an estimate of 
the corresponding eigenenergy Ej. Similarly to the previ- 
ous section, we will assume for simplicity that this can be 
done exactly, that is, we have access to a quantum circuit 
that acts in the eigenbasis of H as Eh '■ |V'i)|0) >-> 
where \Ej} exactly encodes the eigenenergy Ej. We will also 
assume that the eigenenergies of H are nondegenerate, so 
that each eigenenergy Ej corresponds to a single eigenstate 
[i/ij ), instead of a higher dimensional eigenspace. The quan- 
tum Metropolis sampling algorithm also requires to choose 
a set of quantum gates C that will play the role of the pos- 
sible random moves between eigenstates. In this 
given quantum gate Ci £ C will not simply move an initial 
eigenstate [V'i) to another eigenstate [t/'j), but rather to a 
superposition Cilipi) = J2jCi'j\i>j) where cfj' := {ipj\Ci\ipi) . 

We can now give a high-level description of the quantum 
Metropolis sampling algorithm by Temme et al. [46]. Let 
\tpi)\Ei) be an initial state, that can be prepared by applying 
the phase estimation operator Eh on an arbitrary state, and 
measuring the energy register. The algorithm implements 
each random move by performing the following steps: 

1. Apply a random gate C; G C on the first register to 
prepare the state (C;|i/)i))|£i) = J2j 4'j'\i'j)\Ei) ■ 

2. Apply the phase estimation operator Eh on the |i/)j) 
register and an ancilla register initialized in the default 
state |0) to prepare the state cfJ\'tpj)\Ei)\Ej). 



3. Add another ancilla qubit prepared in the state |0) and 
apply a controlled-rotation on this register to create 

the state Y.j <^:^\i^j}\Ei)\Ej) + ^W^jO)] , 

where fij :— min{l, exp(/?(i5i — Ej))}. 

4. Measure the last qubit. If the outcome is 0, reject the 
move by reverting the state to \ilJi)\Ei) (see [46] for 
details) and go back to Step 1. Otherwise, continue. 

5. Discard the \Ei} register and measure the \Ej) register 
to project the state onto a new eigenstate \tpj)\Ej}. 

It is shown in [46] that by choosing a universal set of quan- 
tum gates for the set of moves C, the algorithm simulates 
random walk on the set of eigenstates of H that satisfies 
a quantum detailed balanced condition, which ensures that 
the walk converges to the Gibbs distribution, as in the clas- 
sical case. 

For a given initial state \tpi)\Ei), the probability (over all 
choices of the randomly chosen gate Ci) that the measure- 
ment in Step 4 succeeds is j^'}2j i fijl'i'jl'^ ■ define 

„{») ._ . /f, . /i^i^W 



a vector ly'*-* whose components are 
then this probability is simply [[ti;'-'-' |||. Hence, after one ex- 
ecution of the algorithm (Steps 1-5) the initial state \ipi}\Ei) 
gets mapped to \4'j)\Ej) with probability II2. 
We could achieve the same random move by converting the 
initial state \tpi}\Ei) to 



(i) 



\l)\^,)\E,)\E,) 




\i,,)\E,)\E,) (21) 



and discarding the \l) and \Ei) registers and measuring the 
\Ej) register to project on the state \il)j)\Ej) with the cor- 
rect probability. This implies that one random move reduces 
to a quantum state conversion problem that we will call 
QMetropolisMovEj;. This problem assumes that we are 
able to perform a perfect phase estimation on the Hamilto- 
nian H. Therefore, similarly to the previous section, we fix 
a set of possible eigenenergies £ of finite cardinality n := |f | . 

Definition 8. The quantum Metropolis move problem, de- 
noted by QMetropolisMovE(^ , is a quantum state conver- 
sion problem (O, ^t, X), where 

X ~ {{H,i) e Herm(d) x [d] : spec{H) G E"^}. 

Oracles in O act as i5_r/ : |V'j)iO)n | 'i/'j ) j -Ej ), with the corre- 
sponding initial states \'4>i), the eigenvectors oi H, and target 



^^hm,) where u;« := ^J~md 



states J 

:= min{l,exp(/3(£, - E,))}, and c^'f := {i>j\Ci\^^) 



A critical part of the algorithm from [46] described above 
is how to revert a rejected move in Step 4. Temme et al. 
show how this can be done by using an unwinding technique 
based on successive measurements, but we will not describe 
this technique in detail, as we now show how this step can be 
avoided by using quantum rejection sampling. Intuitively, 
this can be done by using amplitude amplification to en- 
sure that the measurement in Step 4 always projects on the 
"accept" state |1). This also avoids having to repeatedly 



attempt random moves until one is accepted, and the num- 
ber of steps of amplitude amplification will be quadratically 
smaller than the number of random moves that have to be 
attempted until one is accepted. This leads to the following 
statement: 



Theorem 3. There is a quantum algonthm that solves 
QMetropolisMove^ with success probability 1 using an 
expected number of queries 0(l/||iy^''' ||2). 

Proof. The modified algorithm follows the same lines as 
the original algorithm, except that Steps 3-4 are replaced 
by a quantum rejection sampling step. We use a quantum 
coin to choose the random gate in Step 1 in order to make 
it coherent. The algorithm starts by applying the phase 
estimation oracle Eh on the initial state to prepare the state 
\^()i}\Ei), and then proceeds with the following steps: 

1. Prepare an extra register in the state X^j 10- Con- 
ditionally on this register, apply the gate £ C on the 
eigenstate register to prepare the state 



1 



E 



mm. 



2. Apply the phase estimation operator Eh on the second 
register and an ancilla register initialized in the default 
state |0)n to prepare the state 



-T 



3. Convert this state to the state given in Eq. (21) 




\^j)\E,)\E,). 



4. Discard \Ei) and uncompute \Ej) by using one call to 
the phase estimation oracle -Bjj. 

Note that Step 3 is an instance of SQSampling.^, where 
the pair of basis states \E}\E') of the phase estimation reg- 
isters plays the role of the states |fc), the initial amplitudes 

nE,E' are given by ^^EJ^lj^P ^or {E,E') = {E,,E,) 
or for values (E,E') that do not correspond to a pair 
of eigenvalues of H, the states Wfjl' 
play the role of the unknown states \^k), and the ratio be- 
tween the initial and target amplitudes is given by te^e' ~ 
sj min{l, exp(/3(i5 — -E'))} iS^^ reduction is summarized in 
Table 2). Therefore, this step may be performed using the 
algorithm in Lemma 4. Here, we choose a = 1 since the 
full Quantum Metropolis Sampling algorithm requires to 
apply a large number of successive random moves, there- 
fore each instance of QMetropolisMove^ should be solved 
with high success probability. Choosing a = 1 ensures 
that each random move will have success probability 1 (un- 
der our assumption that the phase estimation oracle is per- 
fect), using an expected number of phase estimation oracles 
0(l/||ii;(")||2). □ 



Note that in this case it is critical that the algorithm only 
requires one copy of the initial state, hence solving the quan- 
tum state conversion problem SQSampling.^ (in contrast. 



the quantum algorithm for linear systems of equations used 
a unitary to create multiple copies of the initial state, which 
is allowed only in the weaker quantum state generation prob- 
lem QSampling^^^). Indeed, creating the initial state re- 
quires one copy of the previous eigenstate which cannot 
be cloned as it is unknown. Here, the algorithm only requires 
to reflect through the initial state, which can be done by in- 
verting Steps 1-2, applying a phase —1 conditionally on the 
eigenenergy register being in the state \Eij (which is possible 
since Ei is known), and applying Steps 1-2 again. 

Repeating the algorithm for QMetropolisMove^ a large 
number of times will simulate the same random walk on the 
eigenstates of H as the original quantum Metropolis sam- 
pling algorithm in [46], except that we have a quadratic 
speed-up over the number of attempted moves necessary to 
obtain an accepted move. In order to converge to the Gibbs 
distribution, we need to take into account this quadratic 
speed-up in order to decide when to stop the algorithm, ef- 
fectively assuming that each move takes quadratically longer 
than it actually does. Another option would be to modify 
the algorithm for QSampling„_>^ so that it also estimates 
||''^''*'||2 by using amplitude estimation or quantum count- 
ing [11, 12]. We leave the full analysis of these technical 
issues for future work. 

5.3 Boolean hidden shift problem 

Our final application of the quantum algorithm for the 
QSampling„_>^ problem is a new quantum algorithm for 
the Boolean hidden shift problem BHSP/. 

We refer to the recent review [19] for a good overview of 
basic properties of the Fourier transform of Boolean func- 
tions. Fourier analysis on the Boolean cube studies the 2"- 
dimensional vector space of all reoZ-valued functions defined 
on the n-dimensional Boolean cube F2 . Thus, in the follow- 
ing definition / denotes a function of the form — >■ K (not 
a Boolean function). The Boolean case is discussed later. 

Definition 9. The Fourier basis of F2 consists of func- 
tions {xm : w £ F2}, where each Xio : ^2 ~^ is 
defined as Xw{x) := (—1)™'^, where w ■ x := X^ILi 
is the inner product in F2. The Fourier transform of a 
function / : F^ R is the function / : F^ R de- 
fined as f{w) ■- ^ E:r6F'«(-l)™"'./'(2;)- Note that f{w) := 
^xixwf) = ^ Y^xGFi^ Xwix)f{x) which is another way to 

write the Fourier coefficients. The set {f{w) : w £ FJ} of 
all values of / is called the spectrum of / and each of its 
elements is called a Fourier coefficient of /. 

Let us consider a Boolean function / : F2 — )■ F2. To find 
its Fourier transform, it is required to associate / with a 
real- valued function F : F2 — >■ R in some way. Instead of the 
obvious correspondence (treating 0, 1 £ F2 as real numbers) 
for the purposes of this work it is more natural to let F be 
the (±l)-valued function defined by F{x) := {~iy^''\ 

Definition 10. By slight abuse of notation, the Fourier 
transform of a Boolean function / : F2 — > F2 is the function 
/ : FJ ^ R defined as 



/H:=E4x»^) = ^ E(-l) 



wx + f{a:) 



Based on a reduction to QSampling„_>^, we can now 
prove the following upper bound on the query complexity of 
BHSP/. 



SQSampling^ 


QMetropolisMove^ 


\k} 


\E}\E') 

TTB B' — < TWl V '^j" iE,E) = [Ei, Ej) where Bi, E^j e spec(i/) 
|o if £ ^ spec(ff) or ^ spec{H) 


16) 


|E,4^'|01^.)/^E, if = (^S^i?.) where E,,E, e spec{H) 
■^'^ \n/a if E ^ spec{H) or ^ spec(//) 


Tk 


TB.B' - Vmin{l,exp(/3(£ -£'))} 



Table 2: Reduction from Step 3 in the new quantum Metropolis sampling algorithm to the quantum resam- 
pling problem SQSampling,.. 



Theorem 4. Let f be a Boolean function and f be its 
Fourier transform. For any p, we have Qi_p(BHSP/) — 
0(1/ ||e^^o.|l2)) where components of it and a are given by 
TTtu = \ fw\ and On, = 1/^/2^ for w G Fa . 

Proof. We will use Of^ to denote the phase oracle for 
function fa, i. e., a diagonal matrix that acts on the standard 
basis vectors a; G Fa as follows: Ofjx) := (— 1)-'^'^"'"'''|2;). 
Let us consider the quantum oracle O/^ conjugated by the 
Hadamard transform. The resulting operation 

Vis) --H^^Of^ H^" 

is very useful, since, when acting on a register initialized 
in all-zeros state, it can be used to prepare the following 
quantum superposition: 

|^/(.)) := v{s)\or- = J2 i-T'^fHH- 

If we could eliminate the Fourier coefficients f{w) from 
state \tpf{s)}, we would obtain a state 

from which the hidden shift s can be easily recovered by ap- 
plying the Ifadamard transform FL®"^ . Luckily, the problem 
of transforming the state |</'/(s)) to |i/'(s)) is a special case 
of QSAMPLING^^g. with 

:=|/H1, a„:= 1/^/2^, {-Vf ^ \^) . 

(More precisely, the initial amplitudes are f(yj) instead of 
[/(w)!. However, the function / and therefore its Fourier 
transform / is completely known, so we can easily correct 
the phases using a controUed-phase gate.) As a consequence. 
Theorem 1 immediately gives us a quantum algorithm for 
solving this problem. □ 

The complexity of the algorithm is limited by the smallest 
Fourier coefficient of the function. By ignoring small Fourier 
coefficients, one can decrease the complexity of the algo- 
rithm, at the cost of a lower success probability. However, 
the success probability of this algorithm can be boosted us- 
ing repetitions, which requires to construct a procedure to 
check a candidate shift. We propose such a checking pro- 
cedure based on a controUed-SWAP test. The number of 
necessary repetitions may then be decreased quadratically 
using the amplitude amplification technique of [28] (note 



that we cannot use the usual amplitude amplification algo- 
rithm since the checking procedure is imperfect). This leads 
to the following theorem (proved in Appendix B): 

Theorem 5. Let f be a Boolean function and f be its 
Fourier transform. Moreover, let p,"f G [0, 1] be such that 
||e||j — ^2"p, wheree^ = min{ | | , 7/\/2" } . Then, for any 
5>Q,we have Qi(BHSP/) = 0(^(1/ ||e||2 + l/s/Tf)). 

Conclusion and open problems 

We provide an algorithm for solving the quantum resampling 
problem. Our algorithm can be viewed as a quantum version 
of the classical rejection sampling technique. It relies on 
amplitude amplification [12] to increase the amplitude of 
some target "accept" state, and its query complexity is given 
by a semidefinite program. The solution of this SDP and 
hence the cost of the algorithm depends on the ratio between 
the amplitudes of the initial and target states, similarly to 
the case of the classical rejection sampling where the cost is 
given by the ratio of probabilities. Using the automorphism 
principle over a unitary group, we derive an SDP for the 
lower bound that is identical to the one for the upper bound, 
showing that our algorithm has optimal query complexity. 

While the original adversary method cannot be applied 
as is for this quantum state generation problem because the 
oracle encodes an unknown quantum state instead of some 
unknown classical data, it is interesting to note that the 
query complexity of this problem is also characterized by 
an SDP. Therefore, an interesting open question is whether 
the adversary method [5, 27], which has been shown to be 
tight for evaluating functions [40, 41, 34] and nearly tight 
for quantum state generation or conversion problems with 
classical oracles [34], can always be extended and shown to 
be tight for this more general framework of problems with 
quantum oracles. 

In Sect. 5, we illustrate how quantum rejection sampling 
may be used as a primitive in algorithm design by provid- 
ing three different applications. We first show that it was 
used implicitly in the quantum algorithm for linear systems 
of equations [26]. By assuming a perfect phase estimation 
operator on the matrix of the system, we show that this 
problem reduces to a quantum state conversion problem 
which we call QLinearEquations^, which itself reduces 
to SQSampling^. An open question is how to combine 
the quantum rejection sampling approach with the variable 
time amplitude amplification technique that was proposed 
by Ambainis [6] to improve on the original algorithm by Har- 
row et al. [26] . In order to do so, we should "open" the phase 



estimation black box since Ambainis's main idea is to stop 
some branches of the phase estimation earlier than others. 

As a second application, we show that quantum rejection 
sampling can be used to speed up the main step in the orig- 
inal quantum Metropolis sampling algorithm [46]. The gen- 
eral idea is to use amplitude amplification to increase the 
acceptance probability of a move, and therefore quadrati- 
cally reduce the number of moves that have to be attempted 
before one is accepted. While this approach also provides 
some type of quadratic speed-up, it is rather different from 
the "quantum-quantum" Metropolis algorithm proposed by 
Yung and Aspuru-Guzik [52]. The main difference is that 
the approach based on quantum rejection sampling still sim- 
ulates the same classical random walk on the eigenstates of 
the Hamiltonian, whereas the quantum-quantum Metropolis 
algorithm replaces it by a quantum walk. Note that while 
random walks converge towards their stationary distribu- 
tion from any initial state, this is not the case for quantum 
walks as they are reversible by definition. Therefore, while 
both the original quantum Metropolis sampling algorithm 
and our variation can start from any initial state and run at a 
fixed inverse temperature /3 to converge to the corresponding 
Gibbs distribution, the quantum-quantum Metropolis sam- 
pling algorithm works differently: it starts from a uniform 
superposition, which corresponds to the Gibbs distribution 
at /3 = 0, and uses a series of measurements to project this 
state onto superpositions corresponding to Gibbs distribu- 
tions with increasingly large /3, until the desired value is 
reached. 

Finally, as shown in Sect. 5.3, we can apply the quan- 
tum rejection sampling technique to solve the hidden shift 
problem for any Boolean function /. In the limiting cases of 
flat or highly peaked Fourier spectra we recover the quan- 
tum algorithm for bent functions [42] or Grover's algorithm 
for delta functions [23], respectively. For a general Boolean 
function the hidden shift problem can be seen as lying some- 
where between these two extreme cases. While the algo- 
rithm is known to be optimal for the extreme cases of bent 
and delta functions, its optimality for more general cases re- 
mains an open problem. A related question is the optimality 
of the checking procedure that leads to Theorem 5. 
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APPENDIX 

A. WATER-FILLING VECTOR IS 
OPTIMAL FOR THE SDP 



We show that the optimal value is attained by £ = e^^„. 
Recall that by Def. 5, we have Sk ~ mm{nk,'yo-k} and 

■ e = Vp, (23) 

so that this vector satisfies the constraints in (22) and is 
therefore a feasible point. As a consequence M = e • is 
also a feasible point for the SDP (4), which implies that its 
objective value is at least Tr M = ||e||2- 

We now want to find a feasible dual solution that gives 
the same objective value for the dual of SDP (4), which can 
be written as [47] 

n 

min VAfcTTfc s.t. A- I + ^l^pI - a ■ cr'^) y 0, (24) 

fc — 1 

where A := diag(Afe \ k — 1, . . . ,n). Indeed, if an objective 
value is feasible for both the primal and the dual, it implies 
that this is the optimal value. 

We prove that the following solution is feasible for the 
dual: 



1, 



(Er=i 



(25) 



This choice yields ||e||2 as the dual objective value, so it 
remains to show that it satisfies the constraints in (24). Let 
us first prove that /i > 0, which is equivalent to 



E 



2 

(^kTVk 



<P- 



(26) 



Let us decompose the vector n into two orthogonal parts 
such that TT = 7r< + 7r>, where 7r< corresponds to com- 
ponents TTfc such that TVk < 70"fe, and 7r> to the remain- 
ing components. Decomposing cr and e similarly, we have 
£ — 7r< -f- 7(T>. The following are straightforward 



- Ik>|l2 

2 II l|2 

-7 l|o->ll2 



T T 2 



Using these equalities, we obtain 



Lemma 1. Let p e [pmin,Pmax], and e = e^^„. 
the following SDP 

maxAf>_o Tr Af s.t. Vfc : 7r| > Mkk, 

Tx[{a ■ CT^ - pI)M] > 0. 



Then, 
(4) 



has optimal value ||e||2; which is achieved by the rank-1 ma- 
trix M — e ■ . 

Proof. We now show that the optimal value of the SDP 
in Eq. (4) can be attained by a rank-1 matrix M. Imposing 
the additional constraint that M can be written as M — e-e^ 
for some e G R", the optimization problem (4) reduces to 

max£^_>o WeWl s.t. \fk : iVk > Sk > 0, , , 
where e :— e/ \\e\\2 denotes a unit vector in direction e. 



E 



"•fc^fc _ T ^ I 1 11.^ ||2 



7r< ■ (T< 



i(l 

7 



F< 



Ml). 



(27) 



Therefore, the left hand side of (26) can be written as 



E 



--PM2 + 



— fl-lkll?) 



where we have used (23). Since < 70-^, we have ||e||2 < 
7e^ ■ (T, which, together with (23) implies that < p. 

Together with ||e||2 < UttHj ~ 1, this impUes 



\\e\\l + 



<P, 



which proves (26) and, in turn, fJ. > 0. 

We now show that At > for all k £ [n]. From Eqs. (25) 
we see that this is equivalent to showing 

■^fc-T _ _^ P ^ 2^k = l sk 



— e ■ f — P > 

£fc i-||e||2 

Note that 1 > ||e||2- By multiplying out everything with 
1 — II e II 2 and expanding, we get 



Ok T /, 
— e • (T 1 



Iklla) +Pl|e|l2 > e"^ ■ o-^Z 



WTfe 



Note that p ||e|l2 = {s^ ■ c)^, so after rearranging terms and 
dividing by • cr we get 



0"fe 



l-||e||^)+e^-a>^ 



Okl^k 

£k 



We apply Eq. (27) to the right hand side and get 



e""" • fT > ■ cr -\ — (l — Hellj) 



After simplification this yields Sk < 70"fc, which is true by 
definition of e. Thus, we have \k > 0. 

Finally, it remains to show that the following matrix is 
positive semidefinite: 



^CTiEi j • diag((Tfc/efc) - o" • cr^ 



A-/+^(p/-o--(T^) 



Since > 0, it is the case if and only if 

This follows by Cauchy-Schwarz inequality: (X^T^i '^i^i) ' 
(ELi vlok/£k) > (ELi V^i^ek ■ ^Jvla^^le-kf . □ 

B. BOOSTING THE SUCCESS PROBABIL- 
ITY 

When we want to find the hidden shift with probability 
close to one, the algorithm in Theorem 4 might be quite 
inefficient as, in the special case p = 1, its complexity is lim- 
ited by the smallest Fourier coefficient (in particular, when 
some Fourier coefficients are zero, it is not possible to ob- 
tain p = f ). Another approach to find the hidden shift with 
near certainty would be to use the algorithm with a smaller 
p and repeat until the right shift is obtained. However, this 
requires a procedure to check a candidate shift. Classically 
this can be done, e. g., by querying the oracle on several in- 
puts uniformly at random and checking if the output agrees 
with the shifted function. Using this strategy one can boost 
the success probability arbitrarily close to f by using O ( f /!/ ) 
queries to the shifted function /s. 



Definition 11. For any Boolean function / and n G F2, 
we call I/(u) = Pra;[/(a;) 7^ f{x + v)] the influence of v over 
/, and 1/ = min„I/(i)) the minimum influence over /. 

However, on a quantum computer one can check a candidate 
shift with only 0(f /-^/l/) oracle calls using a procedure sim- 
ilar to controUed-SWAP test. If we combine this imperfect 
checking procedure with the quantum search algorithm with 
bounded-error inputs from [28], we get the following result: 

Theorem 5. Let f be a Boolean function and f be its 
Fourier transform. Moreover, let p, 7 G [0, 1] be such that 

{|/»|,7/V2^}. Then, for any 
:^(I/||e||2 + l/yi7)). 



||e||j = ^2"p, where = 
S>0, we have Qf (BHSP/) = O 



H 



V 



w 



H 



Figure 5: A one-sided test for checking if states \tp} 

and \(t}) are equal. If V\0)n = lip) and W\0)„ = \(p) 
then the above circuit prepares a state ^[\0){\ip) + 

+ |l)(l''/') ^ Iv'))]- If tli^ first register is measured 
in the standard basis, we get outcome ("accept") 
with probability p(0) = | |||i/') + !v')|l2 = § (1 + Re(V'|<^)). 
Note that we never get outcome 1 if = \if) . 

Proof. Let us first show how to check a candidate shift 
V, assuming that s is the actual shift. Using one call to the 
oracle O/^ , we can easily prepare the state 



f(x + s) 



X) 



Similarly, we can prepare the state \4>f{v)) by applying a 
transformation corresponding to oracle O . The inner prod- 
uct between these two states is 

{0,(.)|^,(«)) = i^^(-I)^(-+=)+^(^+") 

X 

= I-2I/(s-f«). 

Therefore, the procedure from Fig. 5 will accept the candi- 
date shift V with probability 



l + {<j,f{sMs{v)) 



I-I/(s + ^;), 



that is, it will always accept \i s = v, and reject with prob- 
ability at least 1/ otherwise. Repeating this test 0(1/I/) 
times, we can ensure that a wrong candidate shift is rejected 
with high probability. Moreover, using once again quan- 
tum amplitude amplification [12], we can obtain a quadratic 
improvement, and therefore reject a wrong candidate using 
only Oil/ y/Tf ) oracle calls. 

Using the algorithm from Theorem 4 for success proba- 
bility p, we can then boost the success probability to any 
constant 1 — 6 using the quantum search algorithm with 
bounded-error inputs of [28] (note that using the usual quan- 
tum amplitude amplification technique [12] would incur an 
additional factor of log(f/p) since the checking operation 
is imperfect). Therefore, the total complexity comes from 
repeating 0(l/y^) times the algorithm in Theorem 4, with 



cost 0(1/ I 



and the checking operation, with cost 



0(l/v/I/)- □ 



